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10 FIELD OF THE INVENTION 

1 1 The invention relates to PLDs, more particularly to protection of designs 

12 loaded into a PLD through a bitstream. 
13 

14 BACKGROUND OF THE INVENTION 

15 A PLD (programmable logic device) is an integrated circuit structure that 

16 performs digital logic functions selected by a designer. PLDs include logic blocks 

17 and interconnect lines and typically both the logic blocks and interconnections are 

1 8 programmable. One common type of PLD is an FPG A (field programmable logic 

19 device), in which the logic blocks typically include lookup tables and flip flops, 

20 and can typically generate and store any function of their input signals. Another 

2 1 type is the CPLD (complex programmable logic device) in which the logic blocks 

22 perform the AND function and the OR function and the selection of input signals 

23 is programmable. 
24 

25 Problem with storing bitstream external to PLD 

26 Designs implemented in PLDs have become complex, and it often takes 

27 months to complete and debug a design to be implemented in a PLD. When the 

28 design is going into a system of which the PLD is a part and is to be sold for profit, 

29 the designer does not want the result of this design effort to be copied by someone 

30 else. The designer often wants to keep the design a trade secret. Many PLDs, 

3 1 particularly FPG As, use volatile configuration memory that must be loaded from 

32 an external device such as a PROM every time the PLD is powered up. Since 
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1 configuration data is stored external to the PLD and must be transmitted through 

2 a configuration access port, the privacy of the design can easily be violated by an 

3 attacker who monitors the data on the configuration access port, e.g. by putting 

4 probes on board traces. 

5 

6 Current solutions and their disadvantages 

7 Efforts have been made to encrypt designs, but it is difficult to make the 

8 design both secure from attackers and easy to use by legitimate users. The 

9 encryption algorithm is not a problem. Several encryption algorithms, for 

10 example, the standard Data Encryption Standard (DES) and the more secure 

1 1 Advanced Encryption Standard (AES) algorithm, are known for encrypting blocks 

12 of data. The process of cipher block chaining (CBC), in which an unencrypted 

13 data word is XORed with the next encrypted data word before decryption allows 

14 the DES or AES to encrypt a serial stream of data and these are therefore 

1 5 appropriate for encrypting a bitstream for configuring a PLD. A key used for 

16 encrypting the design must somehow be communicated in a secure way between 

17 the PLD and the structure that decrypts the design, so the design can be decrypted 

1 8 by the PLD before being used to configure the PLD. Then, once the PLD has been 

19 configured using the unencrypted design, the design must continue to be 

20 protected from unauthorized discovery. 

2 1 A November 24, 1997 publication by Peter Alfke of Xilinx, Inc. entitled 

22 "Configuration Issues: Power-up, Volatility, Security, Battery Back-up" describes 

23 several steps that can be taken to protect a design in an existing FPGA device 

24 having no particular architectural features within the FPGA to protect the design. 

25 Loading design configuration data into the FPGA and then removing the source of 

26 the configuration data but using a battery to maintain continuous power to the 

27 FPGA while holding the FPGA in a standby non-operational mode is one method. 

28 However, power requirements on the battery make this method impractical for 

29 large FPGA devices. 
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1 Nonvolatile configuration memory is another possibility. If the design is 

2 loaded at the factory before the device is sold, it is difficult for a purchaser of the 

3 configured PLD device to determine what the design is. However, a reverse 

4 engineering process in which the programmed device is decapped, metal layers 

5 are removed, and the nonvolatile memory cells are chemically treated can expose 

6 which memory cells have been charged and thus can allow an attacker to learn the 

7 design. Further, nonvolatile memory requires a more complex and more 

8 expensive process technology than standard CMOS process technology, and takes 

9 longer to bring to market. 

10 It is also known to store a decryption key in nonvolatile memory in a PLD, 

1 1 load an encrypted bitstream into the PLD and decrypt the bitstream using the key 

12 within the PLD. This prevents an attacker from reading the bitstream as it is being 

13 loaded into the PLD, and does retain the key when power is removed from the 

14 PLD. Such an arrangement is described by Austin in U.S. Patent 5,388,157. But 

15 this structure does not protect the user's design from all modes of attack. 

16 In addition to design protection, some users need data protection. They may 

17 have generated data within the PLD that should not be lost when the PLD loses 

18 power. It is desirable to protect such data. 

19 There remains a need for a design protection method that is convenient, 

20 reliable, and secure. 
21 

22 SUMMARY OF THE INVENTION 

23 The invention provides several structures and methods for protecting a PLD 

24 from unauthorized use and data loss. 

25 If the PLD is configured by static RAM memory that must be loaded on 

26 power-up, the configuration data must be protected as it is being loaded into the 

27 device. As in the prior art, this is accomplished by encrypting the configuration 

28 data for storing it in a memory outside the integrated circuit device, loading one 

29 or more decryption keys into the PLD and maintaining the keys in the PLD when 

30 powered down, including a decryption circuit within the PLD that uses the key to 
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1 decrypt the configuration data, generating decrypted configuration data within 

2 the PLD and configuring the PLD using the decrypted configuration data. 

3 For additional security, rather than using nonvolatile memory to preserve 

4 keys, the invention preferably uses a battery connected to the PLD to preserve the 

5 key when power is removed from the PLD. Whereas it is possible to remove a 

6 PLD storing keys in nonvolatile memory, decap the PLD and observe which of the 

7 nonvolatile bits are programmed to logic 1 and which are programmed to logic 0, 

8 it is believed that it is very difficult to determine the contents of keys stored only 

9 in static memory cells since power must be maintained to the memory cells storing 

10 the keys in order for the keys to even be stored, and the PLD would have to be 

1 1 decapped, delayered, and probed while operating power is continuous to the 

12 PLD. 

13 

14 Ways an attacker can steal a design once lo aded into a PLD 

15 If a key does not offer sufficient security, an attacker may break the 

16 encryption code and determine the value of the key. The well-known Data 

1 7 Encryption Standard DES used a 56-bit encryption key, and has been broken in a 

18 few hours by a sophisticated computer to reveal the key. DES is described by 

19 Bruce Schneier in "Applied Cryptography Second Edition: protocols, algorithms, 

20 and source code in C" copyright 1996 by Bruce Schneier, published by John Wiley 

2 1 & Sons, Inc., at pages 265-278. If it is desirable to use such a well known 

22 encryption standard, then in order to increase security, the configuration data may 

23 be encrypted several times using different keys each time, thus strengthening the 

24 encryption code by about 2 56 each time the encryption is repeated. Or it may be 

25 encrypted using a first key, decrypted using a second key, and encrypted using a 

26 third key, a combination that is part of the triple DES standard. Other encryption 

27 algorithms may also be used, and it is not necessary to keep the algorithm secret 

28 since the security resides in the key. When the encryption method is symmetrical, 

29 the same keys used for encryption are stored in the PLD and used in reverse order 

30 for decryption. 
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1 In a PLD offering multiple keys, if the number of keys to be used and the 

2 addresses of all keys were provided in an unencrypted bitstream, an attacker 

3 might be able to attack the keys one at a time and more easily determine the key 

4 values. To avoid such attack, additional security is achieved by storing within the 

5 keys, not the bitstream, an indication of how many keys are to be used and 

6 whether a key is the last key of a set or whether more are to follow. 

7 If the PLD offers the option of reading back the bitstream after it has been 

8 loaded into the PLD, another method that can be used by an attacker is to read 

9 back this bitstream. To avoid this method of attacking the design, in one 

10 embodiment, a PLD that offers readback and also offers encryption includes the 

1 1 ability to disable the readback feature when encryption has been used. In another 

12 embodiment, the PLD that offers the ability to read back encrypts the 

13 configuration data before it is read back. 

14 Additionally, some PLDs offer the option of partial configuration (where 

15 several configuration addresses are specified for loading several portions of a 

16 design) and partial reconfiguration (where an existing design is not erased before 

17 new design data are loaded). If the PLD offers these options, an attacker could 

18 partially reconfigure a PLD to make successive portions of the design visible, and 

19 probably learn the whole design. To avoid such an attack, in one embodiment, 

20 partial configuration and reconfiguration of PLDs loaded with encrypted designs 

21 are disallowed. In another embodiment, several configuration addresses can be 

22 specified, but the addresses are encrypted. 

23 Yet another mode of attack is to try to flip a bit that indicates the security 

24 status of the PLD. Lowering or raising the operating voltage, changing the 

25 temperature, and applying noise to certain ports come to mind. To protect against 

26 such bit-flipping, when the PLD is operating with a secured bitstream, a secure- 

27 mode flag is set, and in one embodiment, if this flag becomes unset, all 

28 configuration data is erased. In another embodiment that doesn't allow for 

29 reconfiguration while the device is still operating, the configuration data is erased 

30 before any bitstream is sent. 
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1 Another mode of attack is to relocate portions of the encrypted bitstream so 

2 that when they are unencrypted they are placed into visible portions of the PLD 

3 not intended by the designer. To prevent this relocation, address information is 

4 used in the encryption and decryption processes so that sending a portion of an 

5 encrypted bitstream to a different PLD location from that intended by the designer 

6 will cause it to decrypt differently into data with no meaning. Cipher block 

7 chaining (CBC) is one effective means of achieving this result. In cipher block 

8 chaining, the decrypted data packet (block) is combined using the XOR function 

9 with the next data block before the next block is decrypted, thus the encrypted 

10 data for each data block depends on every block that preceded it and on the order 

1 1 of those blocks. Identical blocks of data will encrypt to different values depending 

12 on the value of the data blocks that preceded them. This way, if the order of the 

1 3 blocks is changed, the bitstream will not decrypt correctly because the place where 

14 the encrypted bitstream is rearranged will scramble subsequent data. Further, the 

15 initial CBC value can be modified to incorporate the address of the data to force 

1 6 the decrypted data to be placed at a specific location in order to decrypt correctly. 

17 Alternatively, if the PLD allowed part of a design to be encrypted and part to 

18 be unencrypted, the attacker could add an unencrypted portion to the encrypted 

19 portion that would read out information about the encrypted portion of the 

20 design. Thus, additional security is achieved by permitting the design to be totally 

21 encrypted or totally unencrypted, but not to be mixed. Further to this, in one 

22 embodiment, when data are being encrypted, additional security is provided by 

23 allowing only a single full-chip configuration following a single starting address 

24 for the configuration data. 

25 Further, in order to allow convenient testing and debugging and to allow the 

26 PLD manufacturer to communicate freely with its customers (the designers who 

27 produce the designs for configuring the PLD), the PLD has both encrypted and 

28 unencrypted modes of operating, and when operating in the encrypted mode, 

29 parts of the configuration bitstream that control loading of the configuration data 

30 into the PLD are still not encrypted. 
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1 As another mode of attack, if the PLD manufacturer gives information freely 

2 about the configuration bitstream format, including header information and 

3 addresses for loading configuration data, and gives information about the 

4 encryption method used, encrypting this well known information would expose 

5 the encryption key to possible discovery. Such exposure is avoided by encrypting 

6 only the actual configuration data and leaving control information unencrypted. 

7 If the PLD manufacturer allows the key memory to be used in both secure 

8 and non-secure modes, an attacker could simply learn the keys by placing the key 

9 memory into non-secure mode and reading out the keys. To avoid such attack, 

10 the PLD manufacturer includes a circuit that causes all keys plus any 

1 1 configuration data loaded into the PLD to be erased when the key memory is 

12 moved to non-secure mode. 
13 

14 BRIEF DESCRIPTION OF THE DRAWINGS 



15 Fig. 1 shows functional relationships in a prior art FPGA. 

16 Fig. 2a, 2b, 2c, and 2d show bitstream format and commands that can be 

17 included in a prior art bitstream. 

1 8 Fig. 3 shows functional relationships in an FPGA according to one 

19 embodiment of the present invention. 

20 Fig. 4a, 4b, 4c, and 4d show bitstream format and commands that can be 

21 included in a bitstream of the present invention. 

22 Fig. 5a and 5b show example unencrypted and encrypted bitstreams. 

23 Fig. 6 shows configuration logic 29 and the lines in bus 27 and bus 28 leading 

24 to decryptor 24. 

25 Fig. 7a shows the modified starting value for outer cipher block chaining 

26 with triple encryption used in one embodiment of the invention. 

27 Fig. 7b shows the corresponding starting value and decryption process used 

28 with Fig. 7a. 

29 Fig. 8 shows flow of the operations for processing a bitsteam. 
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1 Fig. 9 shows a state machine implemented by decryptor 24 to evaluate key 

2 order. 

3 Fig. 10a shows the structure of key memory 23 of Fig. 3. 

4 Fig. 10b shows the structure of the memory cells of Fig. 10a. 

5 Fig. 11 shows the steps performed by control logic 23a of Fig. 10a to erase 

6 keys when made non-secure. 

7 Fig. 12 shows in more detail the battery supply switch of Fig. 10a. 

8 Figs. 13 and 14 show the level shift circuit and voltage detection circuit of the 

9 battery supply switch of Fig. 12. 

10 Fig. 15 shows a state machine for erasing a design when a secure mode is 

1 1 exited. 

12 Fig. 16 shows a block diagram of elements for loading configuration memory 

13 and reading back configuration, including lines disabled when encryption is 

14 present. 
15 

16 DETAILED DESCRIPTION 

17 Fig. 1 shows a prior art structure for an FPGA 10. Hie FPGA includes 



18 programmable logic 11, typically comprising (1) logic blocks with lookup table 

19 combinatorial logic function generators, flip flops for storing lookup table outputs 

20 and other values, and multiplexers and logic gates for enhancing the logic ability 

21 of the programmable logic (2) routing lines and programmable interconnection 

22 points for routing signals around the FPGA, and (3) input/ output blocks for 

23 driving signals between the routing lines and the external pins of the FPGA. 

24 The FPGA also includes configuration memory 12 for turning on routing 

25 transistors, controlling multiplexers, storing lookup tables and controlling the 

26 input/output blocks, all of this for the purpose of configuring the FPGA to 

27 perform the function desired by the designer(s). Bus 16 connects configuration 

28 memory 12 to programmable logic 11 and is typically a distributed set of control 

29 lines located throughout the FPGA. Some Xilinx products (e.g. XC6200) have 

30 included a bus 17 by which programmable logic 11 causes configuration logic 14 
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1 to send programming information to configuration memory 12. Such a structure 

2 is described by Kean in U.S. Patent 5,705,938. 

3 FPGA 10 further includes a JTAG logic block 13 for interfacing with JTAG 

4 port 20, especially intended for testing of the board in which the FPGA will be 

5 placed. JTAG logic block 13 implements the IEEE standard 1532, which is a 

6 superset of the IEEE standard 1149.1. JTAG allows debugging of a design at the 

7 board level. 

8 Finally FPGA 10 includes configuration logic 14 for responding to a 

9 configuration bitstream from external source 15 on configuration access port 

1 0 21and for interfacing with JTAG logic block 13. The bitstream on configuration 

1 1 access port 21 is treated as words, in one embodiment 32-bit words. Several of the 

12 words, usually at or near the beginning of the bitstream, are used for setting up 

13 the configuration process and include, for example, length of a configuration 

14 memory frame, and starting address for the configuration data. Bus 19 allows 

15 communication between configuration logic 14 and JTAG logic block 13 so that the 

16 JTAG port can be used as another configuration access port. Bus 18 allows 

1 7 communication between configuration logic block 14 and configuration memory 

18 12. In particular, it carries addresses to select configuration frames in memory 12, 

19 control signals to perform write and read operations, and data for loading into 

20 configuration memory 12 or reading back from configuration memory 12. 

2 1 Configuration Logic block 14 receives instructions and data, and processes 

22 the data according to the instructions. These instructions come into configuration 

23 logic 14 as a bitstream. An instruction, or header, is usually followed by data to 

24 be acted upon. Fig. 2a shows an example bitstream structure. Header A specifies 

25 an action and specifies that a single word, Data A, will follow. Header B specifies 

26 an action and in this case specifies that 4 words of data will follow to be acted 

27 upon. 

28 Fig. 2b shows the default format (format type 001) for a 32-bit header word 

29 in the bitstream used in the Virtex(R) devices available from Xilinx, Inc. (Virtex is a 

30 registered trademark of Xilinx, Inc., assignee of the present invention). This 
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1 format includes three bits to indicate the format type (001), two bits to specify an 

2 op code, 16 bits for a configuration logic register address, and 11 bits for a word 

3 count. The op code can designate a read operation, a write operation, or no 

4 operation. For example, 00 can designate no operation, 01 can designate read and 

5 10 can designate write. The 11 bits for word count can specify 2 11 words or 2048 

6 words. As shown in Fig. 2c, if the word count is greater than this, the word count 

7 bits in format type 001 are set to 00000000000 and the header of format type 001 is 

8 followed by a header of format type 2. Format type 2 uses 27 bits to specify word 

9 count, and can thus specify 2 27 words or 2.68 million words. 

10 Fig. 2d shows the kinds of control information that can be loaded into the 

1 1 registers of Configuration Logic 14 by headers for a Virtex bitstream. For 

12 example, a header (of format 001) having the configuration logic register address 

13 0000 specifies that the next 32-bit data word should be loaded into the cyclic 

14 redundancy check (CRC) register. (Virtex devices use a 16-bit cyclic redundancy 

15 check value so some bits will be padded with 0's.) If the header includes an 

1 6 address 0001, the next data will be loaded into the Frame Address register in order 

17 to specify a frame (column) in configuration memory 12 to receive or provide 

18 data. 

19 The Configuration Logic Register address (16 bits) shown in Fig. 2b provides 

20 the 4-bit values shown in the left column of Fig. 2d that select one of the registers 

2 1 in configuration logic 14 (Fig. 1) into which to place the next 32-bit data word. The 

22 Frame Length register (address 1011) specifies the length of the frame into which 

23 the configuration data will be loaded. (Frame length, or column height, depends 

24 upon the size of the PLD. Larger PLDs usually have taller columns or longer 

25 frames. Specifying the frame length in the bitstream and storing the frame length 

26 in a register rather than providing a different structure in the PLD for placing the 

27 data words into frames allows the internal configuration logic to be identical for 

28 PLDs of different sizes.) 

29 For readback, a read command is placed in the op code field and the Frame 

30 Data Output register is addressed, followed by a Word Count (using Command 

10 
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1 Header Format 2 if necessary). The specified number of words is read back from 

2 configuration memory 12, starting at the address specified in the Frame Address 

3 register, and shifted out on either configuration access port 21 or JTAG port 20. 

4 (Readback data is returned to the port that issued the readback instruction) . 

5 Specifying a word count in a bitstream header or pair of headers (Figs. 2b 

6 and 2c) sets a counter that counts down as the data words are loaded. For many 

7 configuration logic register addresses the word count is 1. But if the bitstream 

8 header has a configuration logic address of 0010 or 0011 to indicate configuration 

9 data are being loaded in or read back, the word count will be much larger. This is 

10 when header format 2 of Fig. 2c is used. Data loaded into configuration memory 

1 1 12 through the frame data input register (address 0010) or read out through the 

12 frame data output register (address 0011) is called the design data because it 

13 causes the FPGA to implement a design or shows the status of a design. The other 

14 register data are control data since they control how the configuration logic 

15 behaves while the logic is being configured or read back. 

1 6 Further detail about configuration of Virtex devices can be found in the 

17 "Virtex Configuration Guide" published October 9, 2000 by Xilinx, Inc. (assignee 

18 of the present invention), 2100 Logic Drive, San Jose, CA 95124. This 

1 9 configuration guide is incorporated herein by reference. 

20 Configuration logic 14 typically performs a cyclic redundancy check on a 

21 configuration bitstream coming in (see Erickson, U.S. Patent 5,321,704 

22 incorporated herein by reference, or see pages 39 through 40 of the above 

23 referenced Virtex Configuration Guide), reads header bits indicating the frame 

24 length of the part being configured and the word count of the configuration data, 

25 reads address instructions identifying where to load configuration data, collects 

26 frames of configuration data and loads them into columns of configuration 

27 memory 12 indicated in the addresses. Configuration logic 14 also controls 

28 readback of configuration data and flip flop values from configuration memory 12 

29 to an external location. In a Virtex FPGA available from Xilinx, Inc., readback can 

30 be done through either JTAG port 20 or through configuration access port 21. 

n 
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1 Configuration logic 14 can also receive configuration data from 

2 programmable logic 11. More information about prior art FPGA structures in 

3 which part of the FPGA configures another part of the FPGA can be found in 

4 Kean, U.S. Patent 5,705,938. More information about architectures of FPGAs 

5 similar to the Virtex architecture can be found in Young et al v U.S. Patent 

6 5,914,616. Both patents are incorporated herein by reference. The format of a 

7 bitstream used with the Virtex product available from Xilinx, Inc., assignee of the 

8 present invention, is described in an Application Note, XAPP138, entitled "Virtex 

9 FPGA Series Configuration and Readback" available from Xilinx, Inc., 2100 Logic 

10 Drive, San Jose, CA 95124 published Oct. 4, 2000. 
11 

12 PLD with Decryption 

13 Fig. 3 shows a block diagram of an FPGA (a type of PLD) according to one 

14 embodiment of the present invention. Some elements are the same as shown in 

15 Fig. 1, are given the same reference numbers, and not explained again. In 

1 6 addition, Fig. 3 includes an expanded configuration logic unit 29, a decryptor 24 

17 and a key memory 23. Fig. 3 shows an embodiment in which key memory 23 is 

18 loaded on bus 25 from JTAG access port 20. In other embodiments, key memory 

19 23 is loaded through another port. Bus 25 carries data, addresses, and control 

20 signals to perform write and read operations and allows programming of the 

2 1 decryption keys from JTAG port 20. In one embodiment, bus 26 allows 

22 programming of the keys from the configuration port. In another embodiment, 

23 bus 26 is eliminated. In yet another embodiment, bus 26 is present and bus 25 is 

24 eliminated. In an embodiment described further herein, bus 26 carries security 

25 data from key memory 23 to configuration logic 29. In one embodiment, bus 27 

26 carries encrypted configuration data from configuration logic 29 to decryptor 24 

27 and carries decrypted configuration data back to configuration logic 29. Bus 28 

28 allows decryptor 24 to access the keys for decrypting data. When the structure of 

29 Fig. 3 is being loaded with encrypted data, an attacker who monitors the bitstream 
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1 encrypted configuration data begins. Fig. 4a shows an example in which three 

2 header words Header A, Header B, and Header C are each followed by three 

3 unencrypted control data words Data A, Data B, and Data C. (In an actual 

4 configuration, more than three control data words will likely be provided. ) Next, 

5 Header D specifies that encrypted configuration data will follow and is followed 

6 by multiple words Data ID, Data 2D, Data 3D, etc. of encrypted configuration 

7 data. These words have been shaded in Fig. 4a to emphasize that this data is 

8 encrypted. 

9 As shown in Figs. 4b and 4c, a fourth op code has been added. In addition to 

10 the values 00 for no operation, 01 and 10 for read and write without decryption, 

1 1 the new value 11 specifies that writing is to be with decryption. (It is not 

12 important what code or what method is used to specify that decryption is to be 

13 used or even that it is specified through an op code. It is just important that 

14 optional encryption and decryption be allowed and indicated, so that designers 

1 5 can make use of this option. In the embodiment of Fig. 4d, two new configuration 

16 logic registers are added. Shown at addresses 1100 and 1101 are the register for 

17 holding a cipher block chaining (CBC) starter value and the address for the initial 

18 encryption key. 
19 

20 Optional Encryption 

2 1 According to another aspect of the invention, a PLD can accept both 

22 encrypted and unencrypted data portions of the bitstream. The control portion of 

23 the bitstream indicates whether the data portion of the bitstream is encrypted. If 

24 the data portion of the bitstream is encrypted, it is diverted within the PLD to a 

25 decryptor and after decryption is used to configure the PLD. If unencrypted, it is 

26 not diverted, and is used directly to configure the PLD. 

27 There are some occasions for which it is preferable not to encrypt the 

28 bitstream. Certain test activities used during debugging a design require reading 

29 back the configuration information. It is more straight forward to diagnose a 

30 configuration problem if an encryption step has not been performed (especially if 

14 



X-805-8 

November 28, 2000 



PATENT 



1 the designer is trying to determine whether encryption has anything to do with 

2 the problem). Also, if several designers are writing code to be implemented in 

3 parts of the PLD and different parts of the PLD are to be configured at different 

4 times, it may be necessary to make all portions of the bitstream visible, and to 

5 allow the PLD to be partly reconfigured. 

6 Figs. 5a and 5b show example bitstream portions representing the same 

7 design, first unencrypted and then encrypted, to illustrate the differences between 

8 an unencrypted bitstream and an encrypted bitstream in one embodiment of the 

9 invention. An actual bitstream includes the O's and l's at the right of the figures 

10 and none of the text at the left. The text at the left is provided to explain the 

1 1 meaning of the bits to the right. These bitstream portions use the commands 

12 illustrated in Figs. 4b-4d. In order to emphasize the differences between the 

13 unencrypted version of Fig. 5a and the encrypted version of Fig. 5b, the 

14 differences are shown in bold. 

15 Looking at Fig. 5a, after a dummy word (a constant high signal interpreted 

16 as all l's) and a sync word with a specified pattern of l's and O's, the next word is 

17 of type 001 with an op code of 10, has an address of 0000000000010000 and a word 

18 count of 00000000001. Thus this word addresses the command register CMD and 

19 specifies that one word will be written there. Fig. 5a has been annotated to the left 

20 of the bitstream to indicate that this word is Type 1 and indicates to write 1 word 

21 to CMD. The following word 111 is the data to be placed in command register 

22 CMD, and resets a CRC (cyclic redundancy check) register. (In a preferred 

23 embodiment, the PLD includes a circuit, not shown, such as described by 

24 Erickson in U.S. Patent 5,598,424 to calculate a CRC value from the bitstream as 

25 the bitstream is being loaded, and protects against glitches in the bitstream 

26 voltages that might cause incorrect bits to be loaded.) Next, a header word 

27 specifies that the format is again type 1 and it specifies to write 1 word to the 

28 frame length register FLR. The data word that follows, 11001, specifies the frame 

29 length (25 words). Similarly, several additional header and data words follow, 

30 including the header specifying the word to be written to the frame address 

15 
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1 register FAR. In this case, the following data word indicates data will start at 

2 address 0. Finally, after these registers have been loaded, a command comes to 

3 write data to the frame data input register FDRI, and since quite a bit of data will 

4 be written, the word count is given as 00000000000 and a header of type 2 specifies 

5 that 10530 words will be written to the FDRI register. This is the actual design 

6 data that causes the PLD to be configured. Thus the next 10530 words in the 

7 bitstream are design data. Finally, to assure that data have been loaded correctly, 

8 the CRC value calculated by the device that originated the configuration data is 

9 loaded and compared to the CRC value that has been calculated by the PLD. 

10 Additional commands and data are loaded in order to indicate that configuration 

1 1 is complete and to move the PLD into operation mode. 

12 Fig. 5b is similar to Fig. 5a, and differs only where the data and annotations 

13 are shown in bold. In Fig. 5b, the data are encrypted, and additional commands 

14 are used to provide the initial key address and to write two words (64 bits) to the 

15 CBC (cipher block chaining) register. Next, a type 1 header includes the op code 

16 11 and indicates that data will be decrypted before being written to frame data 

17 input register FDRI. A type 2 header follows, again with the op code 11, giving 

18 the instruction that 10530 words are to be decrypted and written to data input 

19 register FDRI. The 10530 encrypted data words then follow. Then the CRC word 

20 follows for confirming that the (encrypted) data were loaded correctly. Finally, 

21 the additional commands and data are sent, and place the PLD into operation 

22 mode if all is correct. 

23 

24 Decryption Process 

25 Fig. 6 shows how optional decryption is accomplished in one embodiment. 

26 Fig. 6 shows the detail of configuration logic 29 and of buses 27 and 28 leading 

27 into decryptor 24. Bus 27 includes the following: 

28 • the 3-bit initial decryption key address "Init_key_addr" taken from 

29 register address 1101 (Fig. 4d) in configuration logic 29, 
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1 • the 64-bit modified cipher block chaining value "modCBC". This value is 

2 formed by replacing the lower order bits of the 64-bit CBC value 

3 taken from register address 1100 (Fig. 4d) in configuration logic 29 

4 with the 22-bit Frame Address value specified in Register 0001. 

5 *the 64 lines "Encrypted_data" for loading encrypted data, taken from the 

6 bitstream, 

7 • the 64 lines "Decrypted_data" for returning the decrypted data produced 

8 by decryptor 24 to configuration logic 29, 

9 • a line for the signal "Enc_data_rdy " that tells decryptor 24 that data is on 

10 the "Encrypted_data_ lines and that decryptor 24 can start 

1 1 decrypting, 

12 • a line for the signal "Dec_data_rdy" that tells configuration logic 29 that 

13 decryption on a 64-bit word is complete and is available on the 

14 "Decrypted_data" lines, and 

15 • a Bad_key_set line used by decryptor 24 to cause configuration logic 29 to 

16 abort the configuration and set a status register accordingly when 

1 7 the keys have not been used as specified, for example, by the bits in 

1 8 key memory that designate whether the keys are to be first, middle, 

19 or last of a set. In the embodiment shown in Fig. 4d, the status 

20 register is at address 0111, and the Bad_key_set error is indicated by 

21 storing a logic 1 in one of the bits. 

22 Bus 28 is comprised of the following: 

23 • 3 lines for the key address, which is initially the key address provided 

24 from bus 27, but which is updated each time a new key is used, 

25 • 56 lines for the decryption key, and 

26 • 2 lines for indicating whether the decryption key is the first, middle, last, 

27 or only key to be used. 

28 



17 



X-805-8 PATENT 
November 28, 2000 

1 Preventing Design Relocation 

2 One potential attack on a design in an encrypted bitstream is to change the 

3 frame address register (starting address) in the encrypted bitstream so that when 

4 it is decrypted it is loaded into a portion of the FPGA visible when the FPGA is 

5 being used. In some designs the content of the block RAM is visible. In all 

6 designs the configuration of the input/output ports is visible and therefore the 

7 configuration bits can be determined. Thus if successive portions of the design 

8 were moved to visible portions of the FPGA, even though the FPGA did not 

9 function properly, an attacker could in repeated relocation learn the contents of 

10 the unencrypted bitstream. 

1 1 To prevent design relocation, in one embodiment, an initial value used by 

12 the cipher block chaining method used with the DES standard is modified. Figs. 

1 3 7a and 7b show the encryption and decryption portions of a triple DES algorithm, 

14 respectively, as modified according to the invention. The standard cipher block 

15 chaining method starts the encryption process by XORing a starting number (can 

16 be designer supplied or randomly generated) with the first word of data to be 

17 encrypted. According to the invention, part of the random number is replaced by 

18 address information, in the present example the 22-bit address of the first frame 

19 into which data will be loaded in configuration memory 12. The starter CBC value, 

20 a 64-bit number, has its least significant bits, labeled x, replaced by the frame 

2 1 address, labeled y, to produce a modified 64-bit value that depends upon the 

22 address into which data will be loaded. This modified CBC value is XORed with 

23 the first word of configuration information Wordl . Then the encryption 

24 algorithm is used to produce the first encrypted word Encrypted Wordl, which is 

25 placed into the bitstream. Fig. 7a shows a triple encryption algorithm with outer 

26 cipher block chaining, comprising an encryption step enq using the first key, 

27 followed by a decryption step dec 2 using the second key, followed by an 

28 encryption step enc 3 using the third key. This first encrypted word Encrypted 

29 Wordl is XORed with the second unencrypted word Word2 and the encryption 
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1 process is repeated to produce encrypted Word2. The XOR chaining continues 

2 until all configuration data have been encrypted. 

3 As shown in Fig. 7b, the PLD must perform the reverse process to derive the 

4 decrypted words. For the above encryption sequence, the decryption sequence 

5 would be decryption step dec, using key 3, then encryption step enq using key 2, 

6 then decryption step dec 3 using key 1. Importantly, part of the initial value for 

7 generating Decrypted Wordl is to use the same frame address for both encryption 

8 and decryption. The PLD, not the bitstream, generates the modified CBC value 

9 from the frame address stored in the frame address register, which is also used to 

10 specify the frame of configuration memory 12 into which configuration data are to 

1 1 be loaded. So if an attacker changes the frame address into which the data are to 

12 be loaded, the modified CBC value changes accordingly, and the configuration 

13 data are not correctly decrypted. 

14 The XOR step produces the original data that was in the designer's bitstream 

15 before it was encrypted. Original Wordl = Decrypted Wordl, for example. This 

16 decrypted configuration data is sent on bus 27 (Fig. 3) to configuration logic 29. 

17 

18 Configuration Logic 29 

19 Configuration logic 29 includes the structures to support optional encryption 

20 as well as the structures to prevent design relocation and a single key attack. As 

2 1 shown in Fig. 6, configuration logic 29 includes a holding register 292, control 

22 logic 291, configuration registers (FDRI, FAR, CRC, and init CBC are shown), 

23 decryptor 24 interface multiplexers 294 and 295, 64-bit assembly register 297, and 

24 registers 298 and 299 (for interfacing with configuration access port 21). A 64-bit 

25 shift register 299 receives data from configuration access port 21, which can be a 

26 single pin for 1-bit wide data or 8 pins for 8-bit wide data. This data is loaded into 

27 64-bit shift register 299 until register 299 is full. Then these 64 bits are preferably 

28 shifted in parallel into 64-bit transfer register 298. From there, multiplexer 296b 

29 alternately selects right and left 32-bit words, and multiplexer 296a moves the data 

30 32 bits at a time either into holding register 292 or alternately into High and Low 

19 
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1 portions of assembly register 297 as controlled by control line M. When loading of 

2 the bitstream begins, line M and a clock signal not shown cause multiplexers 296a 

3 and 296b to move data from 64-bit transfer register 298 to holding register 292. 

4 From there these words are applied to control logic 291. If the word is a header, 

5 control logic 291 interprets the word. If the op code indicates the data to follow 

6 are to be written unencrypted, control logic 291 places an address on bus G to 

7 select a register, places a signal on line L to cause multiplexer 294 to connect bus B 

8 to bus D, and applies the following word on bus B. On the next clock signal (clock 

9 signals are not shown), the data on bus D are loaded into the addressed register. 

10 All registers shown in Fig. 4d can be loaded this way. The init CBC register for 

1 1 loading the initial cipher block chaining value is a 64-bit register and receives two 

12 consecutive 32-bit words, as shown in Fig. 5b and discussed above. 

13 A modified CBC value formed from (1) the original CBC value stored in the 

14 init CBC register and (2) the initial frame address stored in the FAR register is 

15 available to decryptor 24. In one embodiment, the initial frame address in the 

16 FAR register uses no more than 32 bits while the init CBC value uses 64 bits. In 

17 the embodiment of Fig. 6, the 64-bit bus providing the modified CBC value 

18 includes 22 bits from the frame address register FAR and 42 bits from the init CBC 

19 register. Important to the security provided by the present invention, note that 

20 this value depends upon where configuration data will be loaded. If an attacker 

2 1 were to try to load encrypted data into a different place by changing the contents 

22 of the FAR register, the modCBC value fed to decryptor 24 would also change. 

23 When the op code command to decrypt a number of words of configuration 

24 data is received by control logic 291, the decryption process begins. Control line 

25 M causes multiplexer 296a to apply data from transfer register 298 to bus A 

26 leading to assembly register 297. Control bus H alternately connects bus A to the 

27 High[31:0] and Low[31:0] portions of encrypted data register 297 to form a 64-bit 

28 word to be decrypted. Control logic 291 then asserts the Enc_data_rdy signal, 

29 which causes decryptor 24 to decrypt the data in register 297. 
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1 



To perform the decryption, decryptor 24 applies a key address KeyAddr on 

2 bus 28 to key memory 23 (Fig. 3). This causes key memory 23 to return the 56-bit 

3 key in that address on the 56-bit Key lines. It also causes key memory 23 to return 

4 two additional bits "Order" also stored in the key data at that address. For the 

5 first decryption key, these two bits must indicate that this is a first key or an only 

6 key. If not, decryptor 24 asserts the Bad_key_set signal, which causes control logic 

7 29 to abort the configuration operation. If these two bits indicate the key is a first 

8 or only key, decryptor 24 performs the decryption, using for example the well 

9 known DES algorithm (described by Schneier, ibid). If the key isn't an only key, 

10 decryptor 24 then gets the key at the next address in key memory 23, and checks 

1 1 to see if the two Order bits indicate it is a middle or last key. If not, the 

12 Bad_key_set signal is asserted and the configuration is aborted. If so, decryption 

1 3 is performed. If it is a middle key, another round of decryption is done. If it is the 

14 last key, decryptor 24 forms the XOR function of the decrypted word and the 

15 value modCBC. Decryptor 24 then places the resultant value on the 64-bit 

16 Decrypted_data bus and asserts the Dec_data_rdy signal. This causes control logic 

17 291 to place signals on control line K to cause multiplexer 295 to break the 64-bit 

1 8 word into two sequential 32-bit words. Control logic 291 places a signal on line L 

19 to cause multiplexer 294 to forward the 32-bit words of decrypted data to bus D. 

20 Control logic 291 also places address signals on bus G to address frame data input 

21 register FDRI. The next clock signal moves the decrypted data to bus E where it is 

22 loaded into the frame register and when the frame register is full, eventually 

23 shifted into configuration memory 12 at the address indicated in the FAR register. 

24 The modCBC value is used only once in the decryption operation. 

25 Subsequent 64-bit words of encrypted data are decrypted and then chained using 

26 the previously decrypted data for the XOR operation. (The value stored in the 

27 FAR register is also used only once to select a frame address. Subsequently, the 

28 frame address is simply incremented every time a frame is filled.) 

29 
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1 Flow of Operations 

2 Fig. 8 indicates the flow of operations performed by configuration logic 29 

3 and decryptor 24. Configuration logic 29 begins at step 70 by loading the bitstream 

4 headers and placing the corresponding data into configuration logic registers 

5 shown in Fig. 4b, including determining bitstream length. At step 71, as a further 

6 part of the start-up sequence, configuration logic 29 reads the first configuration 

7 memory address. Recall that the bitstream format includes an op code that 

8 indicates whether encryption is being used. Step 72 branches on the op code 

9 value. If encryption is not used, the process is shown on the left portion of Fig. 8. 

10 If encryption is used, the process is shown in the right of Fig. 8. For no encryption, 

1 1 at step 73, configuration logic 29 sets a counter equal to the bitstream word count 

12 (see Fig. 4c). At step 74, 32 bits (1 word) of configuration data are sent to the 

13 addressed frame of configuration memory 12. If step 75 indicates the counter is 

14 not finished, then at step 76 the counter is decremented and the next 1 word of 

15 configuration data are sent to configuration memory 12. When the counter has 

16 finished, configuration logic 29 performs cleanup activities including reading the 

17 final cyclic redundancy value to compare with a value at the end of the bitstream 

1 8 to determine whether there were any errors in loading the bitstream. 

19 If step 72 indicates the bitstream is encrypted, the counter is loaded with the 

20 word count, and at step 81 the process loads the initial key address from key 

2 1 address register 293 (Fig. 6) into decryptor 24. 

22 At step 82, two words (64 bits) of encrypted configuration data are loaded 

23 into decryptor 24. At step 83 the addressed key is loaded into decryptor 24. In 

24 one embodiment, a 64-bit number is loaded into decryptor 24. This 64-bit number 

25 includes a 56-bit key, two bits that indicate whether it is the first, middle, last, or 

26 only key, and some other bits that may be unused, used for parity, or used for 

27 another purpose. In another embodiment, the 64-bit key data includes a single bit 

28 that indicates whether it is or is not the last key. In yet another embodiment, the 

29 64-bit key data includes an address for the next key so the keys don't need to be 

30 used in sequential order. In another embodiment, extra bits are not present and 
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1 the key data uses less than 64 bits. In yet another embodiment, the bitstream 

2 rather than the key indicates how many keys are to be used, but this is believed to 

3 be less secure because an attacker can see how many keys are used and perform a 

4 single key attack, breaking one key at a time, whereas using the keys to indicate 

5 how many keys are to be used does not give this information to an attacker. 

6 At step 84, decryptor 24 decrypts the 64-bit data with the 56-bit key using, 

7 for example, the DES algorithm. The DES algorithm is described in the above- 

8 mentioned book by Bruce Schneier at pages 265 to 278. Other encryption 

9 algorithms may also be used, for example, the advanced encryption standard AES. 

10 Other algorithms may require more key bits. For example AES requires a key of 

11 128 to 256 bits. 

12 Step 85 determines whether more keys are to be used. The two bits that 

13 indicate whether the key is first, middle, last, or only key are examined to 

14 determine whether this is the last key, and if not, the key address is incremented 

1 5 and decryptor 24 addresses the next key in memory 23. 

16 After the last key has been used, at step 87, the modified CBC value shown in 

17 Fig. 6 as a 64-bit value from combining registers FAR and init CBC is XORed with 

18 the decrypted value obtained in step 87. In one embodiment, 22 bits of the 64-bit 

19 random number loaded into the CBC register are replaced with the frame address 

20 of the beginning of the bitstream. The goal of the encryption process is to have 

21 every digit of the 64-bit encrypted value be a function of all previous bits plus the 

22 key. The goal of combining the CBC value with the first address is to cause the 

23 decrypted values to change if the bitstream is loaded into a different address from 

24 the intended starting address. Step 87 achieves both goals. The new CBC value is 

25 then stored. Storage may be in the FAR and init CBC registers shown in Fig. 6, or 

26 in another register located in decryptor 24. 

27 At step 88, this decrypted configuration data is sent on bus 27 (Fig. 3) to 

28 configuration logic 29. Configuration logic 29 calculates an updated cyclic 

29 redundancy check value to be compared with the cyclic redundancy value stored 

30 in the CRC register at the end of the loading process. If configuration logic 29 has 
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1 been set to use encryption, a multiplexer in configuration logic 29 forwards this 

2 decrypted configuration data to the addressed column of configuration memory 

3 12. 

4 At step 89 the counter is checked and if not finished, at step 96 the counter is 

5 decremented and the process returns to step 82 where the next 64 bits (2 words) 

6 are loaded from the bitstream. 

7 Finally, when step 89 indicates the counter is finished, at step 90, a CRC 

8 (cyclic redundancy check) value in the bitstream is compared with a CRC value 

9 calculated as the bitstream is loaded. If the values agree, configuration is complete 

10 and the FPGA goes into operation. If the values do not agree, a loading error has 

1 1 occurred and the entire configuration process is aborted. 
12 

13 Evaluating Key Order - Preventing Single Key Attack 

14 Fig. 9 shows a state machine implemented by decryptor 24 to evaluate key 

15 order. The state machine remains in state SI until the Enc_data_ready signal is 

16 activated. This signal indicates decryption can begin and moves to decision state 

17 Ql where decryptor 24 applies the address specified by the address Init_key_addr 

18 on bus 27 to bus 28, reads back a key and a key order, and from the two bits of key 

19 order data determines whether the key is a first or only key. If not, decryptor 24 

20 sends the Bad_key_set signal to control logic 291 and causes configuration logic 29 

2 1 to abort the configuration. If the address is first or only, decryptor 24 goes to state 

22 S3, which decrypts the data. Then the state machine goes to decision state Q2, 

23 which determines whether the key is last or only. If so, decryption is complete 

24 and at state S4 decryptor 24 returns the decrypted data to configuration logic 29. 

25 If not, in state S5, decryptor 24 increments the key address, and gets the new key. 

26 The state machine asks question Q3 to determine whether the next key is a middle 

27 or last key. If not, state S2 causes the configuration to abort. If the key is middle 

28 or last, the state machine returns to state S3 to decrypt the data again. In another 

29 embodiment, in state S4 decryptor 24 also performs the step of XORing the 

30 decrypted data with a CBC value. 
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1 The benefit of storing the key order within the keys is that an attacker can 

2 not implement a single key attack because the attacker can not prevent decryptor 

3 24 from using all the keys specified by key memory 23 (as intended by the 

4 designer) when performing decryption. It is not necessary to ask the second and 

5 third questions Q2 and Q3 to protect against an attacker using a single key attack, 

6 since the key order is stored within the key data inside the PLD. However, it is 

7 beneficial to the designer or board tester who loads the keys to ask all three 

8 questions to make sure that each key has been labeled correctly when it is loaded. 

9 In one embodiment, decryptor 24 uses the triple DES standard with a 

10 decryption-encryption-decryption sequence, alternating the algorithm (only 

1 1 slightly) each time another key is used. Such a combination is in accordance with 

12 the ANSI X9.52 1998 Triple DES standard. In another embodiment, decryption is 

13 used each time. 
14 

15 Key Memory 23 

16 The circuit shown in Fig. 10a includes three components: battery supply 

17 switch 22, control logic 23a and key registers 23b. Control logic circuit 23a and 

18 key registers 23b comprise key memory 23 of Fig. 3. In the embodiment of Fig. 

19 10a, key registers 23b comprise six 64-bit words. Of course, other key memory 

20 sizes may alternatively be used. In other embodiments, there may be far more 

21 than six keys stored in key memory 23, and more than 3 bits needed to give the 

22 address of the key to be used. The power supply for key registers 23b comes from 

23 battery supply switch 22 on line VSWITCH. When key memory supply voltage 

24 VCCI is insufficient or not present, battery supply switch 22 applies the battery 

25 backup voltage VBATT to the VSWITCH line so that VSWHCH carries a positive 

26 voltage. 

27 In this embodiment each key register has 64 memory cells. Each cell receives 

28 a write enable signal WE, that when high causes data to be written to the cell and 

29 when low causes data in the cell to be held. Cells in one register have a common 

30 write enable signal WE. When the PLD supply voltage (different from VCCI) is 
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1 absent such that the WE signals are not actively driven, weak pull-down 

2 transistors such as Tl pull down the WE signal so that none of the key memory 

3 registers can be addressed, and none of the memory cells are disturbed. 

4 In one embodiment, the JTAG port of a PLD is used to load decryption keys 

5 into the PLD. The memory cell supply voltage is at the device voltage level of 

6 VCCI during normal operation, and in one embodiment this level is between 3.0 

7 and 3.6 volts. Signals applied to the JTAG port may be several different voltages. 

8 Also, there may be several different internal voltages. Thus voltage translation is 

9 needed. This voltage translation is performed in the memory cells. Detail of a 

10 memory cell is shown in Fig. 10b. The latch comprising inverters II and 12 is 

1 1 powered by VSWITCH and is thus powered whether or not a device supply 

12 voltage VCCI is present. The WE signal and the inverted data signal data_b both 

13 operate at the 1.5 volt level. These signals drive NMOS transistors T4, T5, and T6, 

14 and through inverter 13 (also using the 1.5 volt supply voltage) transistor T7. Fig. 

15 10b shows that when WE is low, transistors T4 and T5 are off, and the content of 

16 the latch comprising inverters II and 12 is retained. When WE is high, one of 

17 inverters II and 12 is pulled low, thus loading the new data into the latch. 

18 Control logic circuit 23a receives signals from JTAG bus 25 (also shown in 

19 Fig. 3). JTAG bus 25 includes control signals for writing, reading, setting the 

20 secure mode, and data and address buses. This interface conforms to the IEEE 

2 1 1532 JTAG standard. Before key memory 23 can be accessed through JTAG bus 

22 25, the security status (bus 26) is placed in non-secure mode, which can be done 

23 using the ISC_PROGRAM_SECURITY instruction (see Fig. 10a) and applying 

24 logic 1 to bit 0 of the key data bus. Key memory 23 is written to and read (for 

25 verification) from JTAG bus 25 using the ISC.PROGRAM and ISC_READ 

26 instructions of the IEEE 1532 standard. Control logic 23a includes a decoder for 

27 decoding the 3-bit address signal ADDR from JTAG bus 25 to produce a low- 

28 going pulse on the addressed one of write strobe lines ws_b[5:0] if the 

29 ISC_PROGRAM instruction appears on JTAG bus 25, or a high signal on the 

30 addressed one of read select lines rsel[5:0] if the ISC_READ instruction appears 
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1 onJTAGbus25. One of the six 64-bit words can be read by applying a high 

2 signal to one of the six read select lines rsel[5:0], which causes read multiplexer 

3 23d to place the selected word on the 64 output lines q[63:0]. Only one of the write 

4 select lines or read select lines is selected at one time. When no read select signal 

5 is asserted, a high park Jow signal causes 64 transistors 23e to pull down the 64 

6 lines q[63:0] and prevent these lines from floating. 

7 If key memory 23 is operating in non-secure mode, the 64-bit words can be 

8 read from key registers 23b to JTAG bus 25 where the values can be examined 

9 external to the FPGA. The FPGA can be tested in this non-secure mode by using 

10 56 bits of a selected 64-bit word in registers 23b as the 56-bit key for DES 

1 1 decryption. In one embodiment, when key memory 23 is in non-secure mode, 

12 readback of a user's design is possible even though the design has been encrypted 

13 before loading. This allows the designer to test and debug even an encrypted 

14 design. Communication of the key security status is through bus 26 (see also 

15 Fig. 3). 

1 6 After values have been written into key registers 23b and verified with a 

17 read operation from bus 25, control logic 23a is placed into secure mode by using 

1 8 the ISC_PROGRAM_SECURrTY instruction and applying logic 0 to bit 0 of the 64- 

19 bit key data bus which is part of the IEEE 1532 standard. In the secure mode, no 

20 access to the keys is granted. 

21 As shown in Fig. 11, to assure that an attacker can not return to the non- 
22 secure mode by using the ISC_PROGRAM_SECURITY instruction and then 

23 reading out the keys, if the security is eliminated (if the 

24 ISC_PROGRAM_SECURTrY signal moves to the non-secure logic level), a state 

25 machine in control logic 23a erases all keys by writing zeros to all six words, one 

26 word at a time. This is done by: in step 110 putting zeros on the wdata[63:0] bus 

27 and at step 111 asserting the ws_b[0] signal (with a logic 0 value), then at steps 

28 112-117 successively strobing the ws_b[0:0] through ws_b[5:0] signals one at a 

29 time before changing the security status at step 118 and entering the non-secure 

30 mode, and finally at step 119 releasing the wdata[63:0] logic 0 values. Thus, any 

27 



X-805-8 

November 28, 2000 



PATENT 



1 attempt to place battery backed up memory 23 into a non-secure mode causes all 

2 values in key registers 23b to be erased. 

3 To communicate whether key memory 23 is in secure mode, control logic 23a 

4 sends a secure mode signal on bus 26 (may be a single line) to configuration logic 

5 29 to indicate that key memory 23 is operating in secure mode. If this signal 

6 switches to non-secure mode, configuration logic 29 clears the design from 

7 configuration memory 12. Note that an unencrypted bitstream may be loaded by 

8 configuration logic 29 into configuration memory 12 even though keys are stored 

9 in key registers 23b and key memory 23 is in a secure mode. 
10 

11 Loading the Keys, Multiple Encryption Keys 

1 2 Decryption keys must be loaded into the PLD before the PLD is put into a 

13 secure mode where a user can not learn details of the design. In the embodiment 

14 shown in Fig. 3, the key or keys are loaded through a JTAG port 20. 

15 As a feature of the invention, the encryption keys are loaded through this 

16 JTAG port 20. It is expected that JTAG programmers will load the encryption keys 

17 during board testing. When the RAM for storing keys is in a non-secure mode, the 

1 8 user has full access to it and can read out both the keys and the design, even if the 

19 design has been encrypted. This is useful for the designer while testing the keys 

20 and the use of the keys. Then once the designer is satisfied with the operation, he 

2 1 or she can send another instruction through the JTAG port and place the key 

22 memory into a secure mode. Once the key memory has been placed into secure 

23 mode, the keys can not be read out. Further, moving the key memory from 

24 secure to non-secure mode erases the keys by activating a circuit that starts up the 

25 memory initialization process. (Fig. 15, discussed below, shows a state machine 

26 for performing this function.) 

27 According to one aspect of the invention, more than one key may be used to 

28 encrypt the design. For example, if three keys are to be used, the bitstream is first 

29 encrypted using the first key, then the resulting encrypted bitstream is again 

30 encrypted using the second key, then finally the resulting doubly encrypted 
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1 bitstream is again encrypted using the third key. This triply encrypted bitstream 

2 is stored, for example in a PROM or flash memory on the printed circuit board 

3 that holds the PLD. 

4 For decryption, these keys are used in succession (reverse order) to 

5 repeatedly decrypt the encrypted bitstream. Further to this, if more keys are 

6 stored in the PLD than are used for decrypting a particular design, the encrypted 

7 bitstream may include in an unencrypted portion an indication of how many keys 

8 are to be used, and the address of the first key. Such an embodiment may make it 

9 easier for an attacker to decrypt the bitstream because the attacker need only deal 

10 with one key at a time. Alternatively, the keys themselves may indicate whether 

1 1 they are the first, middle, last, or only keys. Thus the same PLD can at different 

12 times be programmed to perform different functions (configured with different 

13 designs), and information about the values of the different keys can be made 

14 available to only one or some of the designers. Thus a first designer may not learn 

15 about a second design even though both designs are implemented in the same 

1 6 PLD (at different times). 

17 Regarding Fig. 3, configuration logic 29 includes additional logic beyond 

18 configuration logic 14 of Fig. 1. As in the structure of Fig. 1, the bitstream on 

19 configuration access port 21 is treated as words, in one embodiment 32-bit words. 

20 Several of the words, usually at or near the beginning of the bitstream, contain 

21 header information, for example length of the bitstream, starting address for the 

22 configuration data. New to the bitstream of the present invention is an indication 

23 as to whether the bitstream is encrypted, and the address of a key for decrypting 

24 configuration data in the bitstream. 
25 

26 Battery Backed up Memory 

27 Values stored in key memory 23 are preferably retained by a battery when 

28 power to the FPGA is removed. 

29 Further, other memories than encryption keys can also be backed up using a 

30 battery supply switch such as switch 22. In particular, a PLD can be 
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1 manufactured in which the VSWITCH voltage supply is routed to all flip flops in 

2 the PLD if the purpose is to preserve data generated by the PLD when the PLD is 

3 powered down. And if the purpose is to also preserve configuration of the PLD 

4 when the PLD is powered down, configuration memory 12 (Fig. 3) may 

5 alternatively be powered from VSWITCH, though such an embodiment requires 

6 considerably more battery power than does powering just the flip flops in the 

7 PLD, and powering flip flops in turn requires more battery power than does 

8 powering a very small memory for storing a few encryption keys. 

9 Fig. 12 shows a structure for battery supply switch 22. In this embodiment, 

10 VBATT level shift circuit 31 allows the PLD to use different voltages for the 

1 1 battery and main power supply. And of course the purpose of the circuit is to deal 

12 with varying voltage levels. In one embodiment, battery supply switch 22 can 

13 handle VCCI voltages up to 3.6 volts,- and switches to battery power when VCCI 

14 falls below about 1 volt. Battery voltage can be between 1.0 volts and 3.6 volts. 

15 Battery supply switch 22 includes four output driving P-channel transistors 

16 P0 through P3. Transistors P0 and PI turn on and off together as do transistors P2 

17 and P3. The circuit includes two transistors for each leg instead of one in order to 

1 8 avoid any possibility that VCCI and VBATT will be connected together. 

19 Transistor P0 includes a parasitic diode (the p-n junction between the drain and 

20 substrate) that can conduct current upward in the figure even when the transistor 

21 is off. To prevent such current flow, transistor PI is added and has its substrate 

22 connected to its drain so that parasitic diode conduction can only be downward. 

23 A similar arrangement is made with transistors P2 and P3. Thus there is no 

24 possibility that current will conduct from VBATT to VCCI or from VCCI to 

25 VBATT. Inverters 33 and 34 are powered from the VSWITCH voltage, so they are 

26 always operational even when VCCI is off. Transistor P4 is a resistor, always on, 

27 and provides protection against electrostatic discharge. Most of the time, the 

28 structures controlled through transistor P4 do not draw current, so there is usually 

29 no voltage drop across transistor P4. 
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1 Fig. 13 shows one embodiment of VBATT level shift circuit 31. Output 

2 voltage at terminal OUT is controlled by signals IN and INB. These signals are 

3 generated by inverters 33 and 34, which derive their supply voltage from the 

4 VSWITCH node. Therefore, if VSWITCH is supplied by VBATT, one of signals IN 

5 and INB will be at voltage VBATT and the other will be at ground. However, if 

6 VSWITCH is supplied by VCCI, one of IN and INB will be at the VCCI voltage 

7 level. If IN is at VCCI and INB is at ground, transistor 45 will be on and transistor 

8 46 will be off. The gate of P-channel transistor 43 will be low, and transistor 43 

9 will be on, pulling the input of inverter 47 to VBATT. The output of transistor 48 

10 will also be at VBATT. Returning to Fig. 12, a voltage level VBATT at the gate of 

1 1 transistor PO will positively turn off transistor PO. 

12 Fig. 14 shows VCCI detect circuit 32. VCCI detect circuit 32 determines 

13 when the voltage on line VSWITCH will be switched to the battery and back to 

14 VCCI. This embodiment of circuit 32 is essentially a string of five inverter stages 

15 II through 15. Controlling of the switching voltage occurs primarily at inverter 

16 stage II. Transistors 52 and 53 form a CMOS inverter. Power to this CMOS 

17 inverter must flow through P-channel transistor 51, which doesn't turn on until 

18 VCCI reaches the threshold voltage of transistor 51, typically 0.7-0.8 volts. If VCCI 

19 is switching slowly, taking several milliseconds to reach full voltage, transistor 51 

20 delays the activation of circuit II. When transistor 51 turns on, the source (upper 

21 terminal) of transistor 52 goes to VCCI. N-channel transistor 53 typically has a 

22 threshold voltage of about 0.7-0.8 volts as well but is sized as a weak transistor 

23 relative to transistor 52. In one embodiment, transistor 53 has a width/ length 

24 ratio of 1/18 whereas transistor 52 has a width/ length ratio of 3/2. So transistor 

25 53 pulls the input of inverter 12 low only until transistor 52 turns on. In one 

26 embodiment, circuit II pulls the input of inverter stage 12 high when VCCI is at 

27 about 1.0 volt. Thus the output of inverter 54 goes low. Inverter stage 13 is a 

28 Schmitt trigger. The zero volt input to inverter stage 13 turns off transistors 56 and 

29 57 and turns on transistor 55, pulling node N3 to VCCI and turning on transistor 

30 58, which pulls up node N4, thus raising the voltage at which transistor 56 will 
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1 turn on, and preventing small variations in VCCI from switching the voltage at 

2 node N3. Inverters 59 and 60 are optional and produce a sharper edge of the 

3 output signals usebatt and usebattb that cause battery supply switch 22 of Fig. 12 

4 to switch from VBATT to VCCI. Transistor 61, controlled by the VBATT' signal, is 

5 a weak pull-down transistor and assures that the usebattb line is pulled low when 

6 VCCI is not present and therefore not providing an output signal from inverter 60. 
7 

8 Key Not Available to Purchaser of a Product Containing the Configured PLD 

9 In order to prevent an attacker from learning the design that has been used 

10 to configure the PLD, several additional steps may be taken. 

1 1 According to another aspect, a key is loaded into the PLD before sale of a 

12 system incorporating the PLD, such that after sale of a system including the PLD, 

13 the design can be loaded into the PLD and used, but an attacker can not learn the 

14 value stored in the key (or keys). Thus the unencrypted design can not be read or 

15 copied. To achieve this security, several steps are taken. 
16 

17 Secure Mode Preservation (Tamper-proofing) 

18 In one embodiment, there are two security flags in configuration logic 29 of 

19 the PLD. One indicates whether the decryption keys are secured, and the other 

20 indicates whether the design is a decrypted design and must be protected. If 

2 1 JTAG logic 13 (Fig. 3) selects secure mode with the ISC^PROGRAM_SECURITY 

22 instruction, a secure_key flag in control logic 23a (Fig. 10a) is set. If the bitstream 

23 loaded into the PLD has the indication that design data in the bitstream is 

24 encrypted, a secure_design flag in configuration logic 29 (not shown) is set. If 

25 either flag is later unset, the entire configuration memory is cleared, thereby 

26 removing the decrypted design. If the secure_key flag is reset (by an 

27 ISC_PROGRAM_SECURITY instruction), then the keys are also erased. 

28 Fig. 15 shows a state machine for performing the design clearing function. 

29 When the secure„design flag is set, the state machine enters state SI. This state 

30 monitors a change from secure to non-secure mode of the secure_design flag. As 
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1 long as the secure-design mode continues, the state machine stays in state SI, 

2 Once a change occurs, the state machine enters state S2 and the data shift registers 

3 for shifting data into configuration memory 12 are reset, thereby placing zeroes on 

4 all data lines for the configuration memory bits. Next, the state machine moves to 

5 state S3 where the word line of the addressed frame is asserted. This results in the 

6 zeros on the data shift register lines being written into the memory bits at the 

7 addressed frame. If question Ql indicates there are more frames to be addressed, 

8 the state machine moves to state S4 where the frame address is advanced and the 

9 state machine returns to state S3. When question Ql indicates there are no more 

10 frames to be addressed, the process is done and the configuration memory is 

1 1 cleared. 

12 It is also necessary to protect the keys from being accessed by an attacker. 

13 Loading of the keys is performed before a system containing the design is made 

14 available to an end customer. When designers are in the process of developing the 

15 design, they may wish to operate the PLD in a non-secure mode for debugging. In 

16 order to allow for this debugging operation and also to preserve security of the 

17 keys, the key loading process begins in a non-secure mode by clearing all key 

1 8 registers. A secure key flag must be kept in the non-secure mode while keys are 

19 loaded and while the keys are read back for verification. The secure key flag may 

20 also be kept in the non-secure mode while a configuration bitstream is loaded and 

21 decrypted. But once the secure key flag is set, returning the secure key flag to the 

22 non-secure mode clears all keys and also initiates operation of the state machine of 

23 Fig. 15. So, not only are the keys cleared, but the configuration is also cleared. 
24 

25 Readback Attack and Readback Disabled 

26 Some FPGAs allow a bitstream to be read back out of the FPGA so that a 

27 user may debug a design or may obtain state machine information from flip flops 

28 in the FPGA. Unless the design were re-encrypted for the read-back operation, the 

29 act of reading back the bitstream would expose the unencrypted bitstream to 

30 view. 
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1 Further security of the design is provided by disabling readback when an 

2 encrypted design is loaded into the FPGA. In one embodiment, readback is 

3 disabled only if the decryption keys are also secured. 

4 Fig, 16 shows the block diagram of a structure for loading and reading back 

5 configuration memory. In one embodiment, configuration logic 29 prevents 

6 readback when two conditions are present: (1) the security status line on data bus 

7 26 (see Figs. 3 and 10) indicates that the keys are in a secure mode, and (2) 

8 configuration logic 29 has responded to op codes in a configuration bitstream that 

9 indicate the bitstream is encrypted. So if either the keys are not secured or the 

10 bitstream is not encrypted, readback can be enabled. In other embodiments, 

1 1 different conditions control whether readback can be enabled. 

12 When configuration logic 29 receives in the bitstream a header indicating 

13 that readback is to be performed, it sends on line 107 the frame address stored in 

14 its frame address register, which is decoded by address decoder 110 to select the 

15 addressed line of bus 109. Next, word line enable signal on line 108 is asserted, 

16 which asserts the selected word line of bus 109 to allow memory cells addressed 

17 by the selected word line to place their values on the n data lines 102 (n is the 

18 frame length and is stored in configuration logic 29). Configuration logic 29 then 

19 asserts the Load signal on line 104 to load the frame of data (in parallel) into data 

20 shift register 101. Next, configuration logic 29 asserts the shift signal on line 105 to 

21 cause data shift register 101 to shift out the frame of data in 32-bit words on bus 

22 103 to the frame data output register (see Fig. 4d) and from there to an outgoing 

23 bitstream on configuration access port 21 (Fig. 3). 

24 If decryption is indicated in the bitstream, configuration logic 29 sets internal 

25 flags to indicate this. If these flags are set and key memory 23 is in secure mode as 

26 indicated by the security status signal on bus 26, then configuration logic 29 

27 responds to a readback command in the bitstream by keeping the word line 

28 enable signal on line 108 inactive and by keeping the load and shift signals on lines 

29 104 and 105 inactive to prevent readback. However, if key memory 23 is not in 
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1 secure mode, even though the design may be encrypted, readback is allowed so 

2 that testing and debugging are possible. 

3 

4 Partial Reconfiguration Attack and Prevention 

5 Some FPGAs allow partial reconfiguration of the FPGA or allow different 

6 parts of a design to be loaded into different parts of the FPGA using separate 

7 starting addresses and separate write instructions. An attacker might attempt to 

8 learn the design by partially reconfiguring the design to read contents of a block 

9 RAM or flip flops directly to output ports or by adding a section to an existing 

10 design to read out information that can be used to learn the design. For example, 

1 1 the attacker might partially reconfigure the PLD with an unencrypted design 

12 whose only purpose is to extract information about the encrypted design. Such a 

13 Trojan Horse design could be loaded into the PLD with another bitstream or 

14 attached to an existing encrypted bitstream. If the attacker was interested in 

15 learning a state machine design loaded into block RAM of an FPGA, for example, 

16 the Trojan Horse design could include logic to cycle through the addresses of the 

17 block RAM and send the block RAM data contents to package pins. 

18 In order to prevent an attacker from making such changes, if the original 

19 design is encrypted, configuration logic 29 disallows partial reconfiguration once 

20 configuration with decryption is started. Configuration logic 29 disallows a 

21 further write instruction once a header with the decryption op code has been 

22 processed. Also, configuration logic 29 disallows configuration with decryption 

23 once configuration without encryption has been done. Configuration logic 29 

24 accomplishes these restrictions by ignoring headers that write to configuration 

25 memory after a decrypt instruction has been received and ignoring headers that 

26 have a decrypt command if an unencrypted portion of a design has been loaded. 

27 Thus, if any op code indicates that writing with decryption is being used, the PLD 

28 will accept only a single write instruction. 
29 

30 Additional Embodiments 
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1 The above description of the drawings gives detail on a few embodiments. 

2 However, many additional embodiments are also possible. For example, instead 

3 of the cipher block chaining algorithm discussed above, one can use an encryption 

4 method called cipher feedback mode in which data can be encrypted in units 

5 smaller than the block size, for example one 8-bit byte at a time. This cipher- 

6 feedback mode is described by Schneier, ibid, at pages 200-203. 



7 In yet another embodiment, if encryption is used, all bitstreams must be 

8 loaded starting at address 0. One implementation of this embodiment replaces 

9 any address loaded into the starting frame address register FAR (Fig. 6) with 

10 address 0 when an op code specifying encryption is received. 

1 1 In still another embodiment, the starting address and the design data are 

12 both encrypted. In this embodiment, it is possible to load several segments of 

13 encrypted design data starting at different frame addresses, just as is possible with 

14 unencrypted design data. 

15 In another embodiment, the key data stored in a key memory such as key 



16 memory 23 specifies the number of keys that will follow. In a variation on this 

17 embodiment, the key data also specify the number of keys that precede the key. If 

18 an attacker gives a key address other than the first key address intended by the 

19 designer, the configuration may be aborted. Additionally, encryption will proceed 

20 until the number of keys specified within the keys have been used. 

21 In another embodiment, instead of allowing keys to be read back when the 

22 key memory is in a non-secure mode, the keys include parity bits or CRC check 

23 bits, and only these bits can be read back for verification that the key or keys were 

24 loaded correctly. This embodiment allows keys known to one designer to be kept 

25 secret from another designer, and is useful when the PLD is to be used at different 

26 times for loading different designs. 

27 Regarding the CRC checksum calculation discussed above, embodiments can 

28 be provided in which the CRC checksum is calculated either before or after a 

29 design is encrypted. Of course, if the checksum added to the bitstream is 

30 calculated before the design data is encrypted, then a corresponding checksum 
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1 must be calculated within the PLD on the design data after it has been decrypted. 

2 Likewise, if the checksum added to the bitstream is calculated after the design 

3 data has been encrypted, then the PLD must calculate the corresponding 

4 checksum on the received bitstream before the design data have been decrypted. 

5 A further note regarding the process of loading the decryption keys, when 

6 the process illustrated in Fig. 8 is used, it is not necessary to use a device 

7 programmer for loading decryption keys. The keys may simply be loaded as part 

8 of the board test procedure. 

9 It is also possible to use the structures and methods described above for 

10 programming more than one PLD. It is well known to use a single bitstream for 

1 1 programming more than one PLD or FPGA, either by arranging several devices in 

12 a daisy chain and passing the bitstream through the devices in series or 

13 addressing the devices in series. It is possible to arrange several PLDs in such an 

14 arrangement when one or more of the devices is to receive encrypted design data, 

15 As yet another embodiment, although one embodiment was described in 

16 which only a single address could be specified for a bitstream having encrypted 

17 design data, in another embodiment, several addresses, preferably encrypted, can 

18 be specified for loading separate portions of a design. Further, these separate 

19 portions may use the same encryption key or keys, or the separate portions may 

20 use different encryption keys or different sets of keys. 

2 1 Variations that have become obvious from the above description are 

22 intended to be included in the scope of the invention. 
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1 CLAIMS 

2 

3 1. A bitstream for configuring a PLD with an encrypted design comprising: 

4 a plurality of unencrypted words for controlling loading of configuration 

5 data; and 

6 a plurality of encrypted words specifying the encrypted design. 

7 

8 2. The bitstream of Claim 1 wherein one of the unencrypted words comprises a 

9 key address for locating a decryption key for decrypting the encrypted words 
10 

1 1 3. The bitstream of Claim 1 wherein one of the unencrypted words comprises an 

12 address register for loading the first word of the encrypted design. 
13 

14 4. The bitstream of Claim 1 further comprising a plurality of encrypted words for 

15 controlling loading of configuration data, wherein one of the encrypted words for 

16 controlling loading of configuration data specifies an address for loading a word 

17 of the encrypted design. 
18 

19 5. The bitstream of Claim 4 wherein another of the encrypted words for 

20 controlling loading of configuration data specifies an address for loading a word 

21 of the encrypted design. 

22 

23 6. The bitstream of Claim 1 wherein the unencrypted words for controlling 

24 loading of configuration data include a cyclic redundancy checksum for 

25 comparison to a cyclic redundancy checksum calculated by the PLD. 

26 

27 7, The bitstream of Claim 6 wherein the cyclic redundancy checksum in the 

28 bitstream is calculated on configuration data before the configuration data has 

29 been encrypted. 

30 
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1 8, The bitstream of Claim 6 wherein the cyclic redundancy checksum in the 

2 bitstream is calculated on configuration data after the configuration data has been 

3 encrypted. 

4 

5 9. A bitstream for configuring a plurality of PLDs comprising: 



6 a first plurality of words for controlling loading of configuration data into a 

7 first PLD; and 

8 a first plurality of words specifying a design for loading into the first PLD 

9 a second plurality of words for controlling loading of configuration data into 

10 a second PLD; and 

1 1 a second plurality of words specifying a design for loading into the second 

12 PLD; 

13 wherein at least one of the first and second pluralities of words specifying a 

14 design is encrypted. 

15 . 



16 10. The bitstream of Claim 9 wherein the first plurality of words specifying a 

17 design for loading into the first PLD is unencrypted and the second plurality of 

18 words specifying a design for loading into the second PLD is encrypted. 

19 

20 11. The bitstream of Claim 9 wherein the first plurality of words specifying a 

21 design for loading into the first PLD is encrypted and the second plurality of 

22 words specifying a design for loading into the second PLD is unencrypted. 

23 

24 12. The bitstream of Claim 9 wherein both of the first and second pluralities of 

25 words specifying a design are encrypted. 

26 

27 13. The bitstream of Claim 12 wherein the first plurality of words specifying a 

28 design for loading into the first PLD are encrypted with a first key and the second 

29 plurality of words specifying a design for loading into the second PLD are 

30 encrypted with a second key. 
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1 

2 14. The bitstream of Claim 1 wherein the plurality of encrypted words further 

3 specify an address into which the encrypted design is to be loaded. 
4 

5 15. The bitstream of Claim 1 wherein the plurality of unencrypted words for 

6 controlling loading of configuration data include a cipher block chaining initial 

7 value. 

8 

9 16. The bitstream of Claim 1 wherein the plurality of encrypted words specifying 

10 the encrypted design are loaded into a single group of successive addresses. 
11 

12 17. The bitstream of Claim 1 wherein the plurality of encrypted words specifying 

13 the encrypted design are loaded into a plurality of groups of successive addresses. 

14 

15 18 A method of generating a bitstream with encrypted design data comprising the 

16 steps of: 



17 forming a cipher block chaining initial value comprising a starting address 

18 for loading a design into a PLD; 

19 combining the cipher block chaining initial value with a first word of design 

20 data to form a first combined word; 

21 encrypting the first combined word to form a first word of encrypted data; 

22 combining the first word of encrypted data with a second word of design 

23 data to form a second combined word; and 

24 encrypting the second combined word to form a second word of encrypted 

25 data. 

26 



27 19. The method of Claim 18 wherein subsequent steps of combining and 

28 encrypting are repeated until all design data has been encrypted. 
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20. The method of Claim 18 wherein the cipher block chaining initial value 

comprises further bits not part of the starting address for loading a design into 
aPLD. 
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1 BITSTREAM FOR CONFIGURING A PLD 

2 WITH ENCRYPTED DESIGN DATA 

3 

4 Stephen M. Trimberger 

5 Raymond C. Pang 

6 Walter N. Sze 

7 Jennifer Wong 

8 Kameswara K. Rao 
9 

10 It is sometimes desirable to protect a design used in a PLD from being 



1 1 copied. If the design is stored in a different device from the PLD and read into the 

12 PLD through a bitstream, an unencrypted bitstream could be observed and copied 

13 as it is being loaded. According to the invention, a bitstream for configuring a 

14 PLD with an encrypted design includes unencrypted words for controlling 

15 loading of the configuration bitstream and encrypted words that actually specify 

16 the design. 
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